cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14a.c

   1 //-----------------------------------------------------------------------------
   2 // 2011, Merlok
   3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency ISO14443A commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include <stdio.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15 #include <unistd.h>
  16 #include "util.h"
  17 #include "../common/iso14443crc.h"
  18 #include "data.h"
  19 #include "proxmark3.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14a.h"
  23 #include "../include/common.h"
  24 #include "cmdmain.h"
  25 #include "../include/mifare.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28 static void waitCmd(uint8_t iLen);
  29
  30 int CmdHF14AList(const char *Cmd)
  31 {
  32         bool ShowWaitCycles = false;
  33         char param = param_getchar(Cmd, 0);
  34
  35         if (param == 'h' || (param != 0 && param != 'f')) {
  36                 PrintAndLog("List data in trace buffer.");
  37                 PrintAndLog("Usage:  hf 14a list [f]");
  38                 PrintAndLog("f - show frame delay times as well");
  39                 PrintAndLog("sample: hf 14a list f");
  40                 return 0;
  41         }
  42
  43         if (param == 'f') {
  44                 ShowWaitCycles = true;
  45         }
  46
  47         uint8_t got[1920];
  48         GetFromBigBuf(got,sizeof(got),0);
  49         WaitForResponse(CMD_ACK,NULL);
  50
  51         PrintAndLog("Recorded Activity");
  52         PrintAndLog("");
  53         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  54         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  55         PrintAndLog("");
  56         PrintAndLog("     Start |       End | Src | Data");
  57         PrintAndLog("-----------|-----------|-----|--------");
  58
  59         int i = 0;
  60         uint32_t first_timestamp = 0;
  61         uint32_t timestamp;
  62         uint32_t EndOfTransmissionTimestamp = 0;
  63
  64         for (;;) {
  65                 if(i >= 1900) {
  66                         break;
  67                 }
  68
  69                 bool isResponse;
  70                 timestamp = *((uint32_t *)(got+i));
  71                 if (timestamp & 0x80000000) {
  72                   timestamp &= 0x7fffffff;
  73                   isResponse = true;
  74                 } else {
  75                   isResponse = false;
  76                 }
  77
  78                 if(i==0) {
  79                         first_timestamp = timestamp;
  80                 }
  81
  82                 int parityBits = *((uint32_t *)(got+i+4));
  83
  84                 int len = got[i+8];
  85
  86                 if (len > 100) {
  87                         break;
  88                 }
  89                 if (i + len >= 1900) {
  90                         break;
  91                 }
  92
  93                 uint8_t *frame = (got+i+9);
  94
  95                 // Break and stick with current result if buffer was not completely full
  96                 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
  97
  98                 char line[1000] = "";
  99                 int j;
 100                 if (len) {
 101                         for (j = 0; j < len; j++) {
 102                                 int oddparity = 0x01;
 103                                 int k;
 104
 105                                 for (k=0;k<8;k++) {
 106                                         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 107                                 }
 108
 109                                 //if((parityBits >> (len - j - 1)) & 0x01) {
 110                                 if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 111                                         sprintf(line+(j*4), "%02x!  ", frame[j]);
 112                                 } else {
 113                                         sprintf(line+(j*4), "%02x   ", frame[j]);
 114                                 }
 115                         }
 116                 } else {
 117                         if (ShowWaitCycles) {
 118                                 uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
 119                                 sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
 120                         }
 121                 }
 122
 123                 char *crc;
 124                 crc = "";
 125                 if (len > 2) {
 126                         uint8_t b1, b2;
 127                         for (j = 0; j < (len - 1); j++) {
 128                                 // gives problems... search for the reason..
 129                                 /*if(frame[j] == 0xAA) {
 130                                         switch(frame[j+1]) {
 131                                                 case 0x01:
 132                                                         crc = "[1] Two drops close after each other";
 133                                                         break;
 134                                                 case 0x02:
 135                                                         crc = "[2] Potential SOC with a drop in second half of bitperiod";
 136                                                         break;
 137                                                 case 0x03:
 138                                                         crc = "[3] Segment Z after segment X is not possible";
 139                                                         break;
 140                                                 case 0x04:
 141                                                         crc = "[4] Parity bit of a fully received byte was wrong";
 142                                                         break;
 143                                                 default:
 144                                                         crc = "[?] Unknown error";
 145                                                         break;
 146                                         }
 147                                         break;
 148                                 }*/
 149                         }
 150
 151                         if (strlen(crc)==0) {
 152                                 ComputeCrc14443(CRC_14443_A, frame, len-2, &b1, &b2);
 153                                 if (b1 != frame[len-2] || b2 != frame[len-1]) {
 154                                         crc = (isResponse & (len < 6)) ? "" : " !crc";
 155                                 } else {
 156                                         crc = "";
 157                                 }
 158                         }
 159                 } else {
 160                         crc = ""; // SHORT
 161                 }
 162
 163                 i += (len + 9);
 164
 165                 EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
 166
 167                 if (!ShowWaitCycles) i += 9;
 168
 169                 PrintAndLog(" %9d | %9d | %s | %s %s",
 170                         (timestamp - first_timestamp),
 171                         (EndOfTransmissionTimestamp - first_timestamp),
 172                         (len?(isResponse ? "Tag" : "Rdr"):"   "),
 173                         line, crc);
 174
 175         }
 176         return 0;
 177 }
 178
 179 void iso14a_set_timeout(uint32_t timeout) {
 180         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
 181         SendCommand(&c);
 182 }
 183
 184 int CmdHF14AReader(const char *Cmd)
 185 {
 186         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 187         SendCommand(&c);
 188
 189         UsbCommand resp;
 190         WaitForResponse(CMD_ACK,&resp);
 191
 192         iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
 193
 194         if(resp.arg[0] == 0) {
 195                 PrintAndLog("iso14443a card select failed");
 196                 return 0;
 197         }
 198
 199         PrintAndLog("ATQA : %02x %02x", card->atqa[0], card->atqa[1]);
 200         PrintAndLog(" UID : %s", sprint_hex(card->uid, card->uidlen));
 201         PrintAndLog(" SAK : %02x [%d]", card->sak, resp.arg[0]);
 202
 203         switch (card->sak) {
 204                 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
 205                 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
 206                 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
 207                 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
 208                 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
 209                 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
 210                 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
 211                 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
 212                 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
 213                 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
 214                 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
 215                 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
 216                 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
 217                 default: ;
 218         }
 219         if(resp.arg[0] == 1) {
 220                 bool ta1 = 0, tb1 = 0, tc1 = 0;
 221                 int pos;
 222
 223                 PrintAndLog(" ATS : %s", sprint_hex(card->ats, card->ats_len));
 224                 if (card->ats_len > 0) {
 225                         PrintAndLog("       -  TL : length is %d bytes", card->ats[0]);
 226                 }
 227                 if (card->ats_len > 1) {
 228                         ta1 = (card->ats[1] & 0x10) == 0x10;
 229                         tb1 = (card->ats[1] & 0x20) == 0x20;
 230                         tc1 = (card->ats[1] & 0x40) == 0x40;
 231                         PrintAndLog("       -  T0 : TA1 is%s present, TB1 is%s present, "
 232                                         "TC1 is%s present, FSCI is %d",
 233                                 (ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
 234                                 (card->ats[1] & 0x0f));
 235                 }
 236                 pos = 2;
 237                 if (ta1 && card->ats_len > pos) {
 238                         char dr[16], ds[16];
 239                         dr[0] = ds[0] = '\0';
 240                         if (card->ats[pos] & 0x10) strcat(ds, "2, ");
 241                         if (card->ats[pos] & 0x20) strcat(ds, "4, ");
 242                         if (card->ats[pos] & 0x40) strcat(ds, "8, ");
 243                         if (card->ats[pos] & 0x01) strcat(dr, "2, ");
 244                         if (card->ats[pos] & 0x02) strcat(dr, "4, ");
 245                         if (card->ats[pos] & 0x04) strcat(dr, "8, ");
 246                         if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
 247                         if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
 248                         PrintAndLog("       - TA1 : different divisors are%s supported, "
 249                                         "DR: [%s], DS: [%s]",
 250                                         (card->ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
 251                         pos++;
 252                 }
 253                 if (tb1 && card->ats_len > pos) {
 254                         PrintAndLog("       - TB1 : SFGI = %d, FWI = %d",
 255                                         (card->ats[pos] & 0x08),
 256                                         (card->ats[pos] & 0x80) >> 4);
 257                         pos++;
 258                 }
 259                 if (tc1 && card->ats_len > pos) {
 260                         PrintAndLog("       - TC1 : NAD is%s supported, CID is%s supported",
 261                                         (card->ats[pos] & 0x01) ? "" : " NOT",
 262                                         (card->ats[pos] & 0x02) ? "" : " NOT");
 263                         pos++;
 264                 }
 265                 if (card->ats_len > pos) {
 266                         char *tip = "";
 267                         if (card->ats_len - pos > 7) {
 268                                 if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
 269                                         tip = "-> MIFARE Plus X 2K or 4K";
 270                                 } else if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
 271                                         tip = "-> MIFARE Plus S 2K or 4K";
 272                                 }
 273                         }
 274                         PrintAndLog("       -  HB : %s%s", sprint_hex(card->ats + pos, card->ats_len - pos - 2), tip);
 275                         if (card->ats[pos] == 0xC1) {
 276                                 PrintAndLog("               c1 -> Mifare or (multiple) virtual cards of various type");
 277                                 PrintAndLog("                  %02x -> Length is %d bytes",
 278                                                 card->ats[pos + 1], card->ats[pos + 1]);
 279                                 switch (card->ats[pos + 2] & 0xf0) {
 280                                         case 0x10:
 281                                                 PrintAndLog("                     1x -> MIFARE DESFire");
 282                                                 break;
 283                                         case 0x20:
 284                                                 PrintAndLog("                     2x -> MIFARE Plus");
 285                                                 break;
 286                                 }
 287                                 switch (card->ats[pos + 2] & 0x0f) {
 288                                         case 0x00:
 289                                                 PrintAndLog("                     x0 -> <1 kByte");
 290                                                 break;
 291                                         case 0x01:
 292                                                 PrintAndLog("                     x0 -> 1 kByte");
 293                                                 break;
 294                                         case 0x02:
 295                                                 PrintAndLog("                     x0 -> 2 kByte");
 296                                                 break;
 297                                         case 0x03:
 298                                                 PrintAndLog("                     x0 -> 4 kByte");
 299                                                 break;
 300                                         case 0x04:
 301                                                 PrintAndLog("                     x0 -> 8 kByte");
 302                                                 break;
 303                                 }
 304                                 switch (card->ats[pos + 3] & 0xf0) {
 305                                         case 0x00:
 306                                                 PrintAndLog("                        0x -> Engineering sample");
 307                                                 break;
 308                                         case 0x20:
 309                                                 PrintAndLog("                        2x -> Released");
 310                                                 break;
 311                                 }
 312                                 switch (card->ats[pos + 3] & 0x0f) {
 313                                         case 0x00:
 314                                                 PrintAndLog("                        x0 -> Generation 1");
 315                                                 break;
 316                                         case 0x01:
 317                                                 PrintAndLog("                        x1 -> Generation 2");
 318                                                 break;
 319                                         case 0x02:
 320                                                 PrintAndLog("                        x2 -> Generation 3");
 321                                                 break;
 322                                 }
 323                                 switch (card->ats[pos + 4] & 0x0f) {
 324                                         case 0x00:
 325                                                 PrintAndLog("                           x0 -> Only VCSL supported");
 326                                                 break;
 327                                         case 0x01:
 328                                                 PrintAndLog("                           x1 -> VCS, VCSL, and SVC supported");
 329                                                 break;
 330                                         case 0x0E:
 331                                                 PrintAndLog("                           xE -> no VCS command supported");
 332                                                 break;
 333                                 }
 334                         }
 335                 }
 336         } else {
 337                 PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
 338         }
 339
 340         return resp.arg[0];
 341 }
 342
 343 // Collect ISO14443 Type A UIDs
 344 int CmdHF14ACUIDs(const char *Cmd)
 345 {
 346         // requested number of UIDs
 347         int n = atoi(Cmd);
 348         // collect at least 1 (e.g. if no parameter was given)
 349         n = n > 0 ? n : 1;
 350
 351         PrintAndLog("Collecting %d UIDs", n);
 352         PrintAndLog("Start: %u", time(NULL));
 353         // repeat n times
 354         for (int i = 0; i < n; i++) {
 355                 // execute anticollision procedure
 356                 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 357                 SendCommand(&c);
 358
 359                 UsbCommand resp;
 360                 WaitForResponse(CMD_ACK,&resp);
 361
 362                 uint8_t *uid  = resp.d.asBytes;
 363                 iso14a_card_select_t *card = (iso14a_card_select_t *)(uid + 12);
 364
 365                 // check if command failed
 366                 if (resp.arg[0] == 0) {
 367                         PrintAndLog("Card select failed.");
 368                 } else {
 369                         // check if UID is 4 bytes
 370                         if ((card->atqa[1] & 0xC0) == 0) {
 371                                 PrintAndLog("%02X%02X%02X%02X",
 372                                             *uid, *(uid + 1), *(uid + 2), *(uid + 3));
 373                         } else {
 374                                 PrintAndLog("UID longer than 4 bytes");
 375                         }
 376                 }
 377         }
 378         PrintAndLog("End: %u", time(NULL));
 379
 380         return 1;
 381 }
 382
 383 // ## simulate iso14443a tag
 384 // ## greg - added ability to specify tag UID
 385 int CmdHF14ASim(const char *Cmd)
 386 {
 387         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
 388
 389         // Retrieve the tag type
 390         uint8_t tagtype = param_get8ex(Cmd,0,0,10);
 391
 392         // When no argument was given, just print help message
 393         if (tagtype == 0) {
 394                 PrintAndLog("");
 395                 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
 396                 PrintAndLog("");
 397                 PrintAndLog("   syntax: hf 14a sim <type> <uid>");
 398                 PrintAndLog("    types: 1 = MIFARE Classic");
 399                 PrintAndLog("           2 = MIFARE Ultralight");
 400                 PrintAndLog("           3 = MIFARE DESFIRE");
 401                 PrintAndLog("           4 = ISO/IEC 14443-4");
 402                 PrintAndLog("");
 403                 return 1;
 404         }
 405
 406         // Store the tag type
 407         c.arg[0] = tagtype;
 408
 409         // Retrieve the full 4 or 7 byte long uid
 410         uint64_t long_uid = param_get64ex(Cmd,1,0,16);
 411
 412         // Are we handling the (optional) second part uid?
 413         if (long_uid > 0xffffffff) {
 414                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",long_uid);
 415                 // Store the second part
 416                 c.arg[2] = (long_uid & 0xffffffff);
 417                 long_uid >>= 32;
 418                 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
 419                 c.arg[1] = (long_uid & 0xffffff);
 420         } else {
 421                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
 422                 // Only store the first part
 423                 c.arg[1] = long_uid & 0xffffffff;
 424         }
 425 /*
 426                 // At lease save the mandatory first part of the UID
 427                 c.arg[0] = long_uid & 0xffffffff;
 428
 429         if (c.arg[1] == 0) {
 430                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 431         }
 432
 433         switch (c.arg[0]) {
 434                 case 1: {
 435                         PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
 436                         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 437                 } break;
 438                 case 2: {
 439                         PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
 440                 } break;
 441                 default: {
 442                         PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
 443                         PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
 444                         PrintAndLog(" type1: 4 ",c.arg[0]);
 445
 446                         return 1;
 447                 } break;
 448         }
 449 */
 450 /*
 451   unsigned int hi = 0, lo = 0;
 452   int n = 0, i = 0;
 453   while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 454     hi= (hi << 4) | (lo >> 28);
 455     lo= (lo << 4) | (n & 0xf);
 456   }
 457 */
 458 //      UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 459 //  PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 460   SendCommand(&c);
 461   return 0;
 462 }
 463
 464 int CmdHF14ASnoop(const char *Cmd) {
 465         int param = 0;
 466
 467         if (param_getchar(Cmd, 0) == 'h') {
 468                 PrintAndLog("It get data from the field and saves it into command buffer.");
 469                 PrintAndLog("Buffer accessible from command hf 14a list.");
 470                 PrintAndLog("Usage:  hf 14a snoop [c][r]");
 471                 PrintAndLog("c - triggered by first data from card");
 472                 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
 473                 PrintAndLog("sample: hf 14a snoop c r");
 474                 return 0;
 475         }
 476
 477         for (int i = 0; i < 2; i++) {
 478                 char ctmp = param_getchar(Cmd, i);
 479                 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
 480                 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
 481         }
 482
 483   UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
 484   SendCommand(&c);
 485   return 0;
 486 }
 487
 488 int CmdHF14ACmdRaw(const char *cmd) {
 489     UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
 490     uint8_t reply=1;
 491     uint8_t crc=0;
 492     uint8_t power=0;
 493     uint8_t active=0;
 494     uint8_t active_select=0;
 495     uint16_t numbits=0;
 496         uint16_t timeout=0;
 497         uint8_t bTimeout=0;
 498     char buf[5]="";
 499     int i=0;
 500     uint8_t data[USB_CMD_DATA_SIZE];
 501     unsigned int datalen=0, temp;
 502
 503     if (strlen(cmd)<2) {
 504         PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] [-t] <number of bits> <0A 0B 0C ... hex>");
 505         PrintAndLog("       -r    do not read response");
 506         PrintAndLog("       -c    calculate and append CRC");
 507         PrintAndLog("       -p    leave the signal field ON after receive");
 508         PrintAndLog("       -a    active signal field ON without select");
 509         PrintAndLog("       -s    active signal field ON with select");
 510         PrintAndLog("       -b    number of bits to send. Useful for send partial byte");
 511                 PrintAndLog("       -t    timeout");
 512         return 0;
 513     }
 514
 515     // strip
 516     while (*cmd==' ' || *cmd=='\t') cmd++;
 517
 518     while (cmd[i]!='\0') {
 519         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
 520         if (cmd[i]=='-') {
 521             switch (cmd[i+1]) {
 522                 case 'r':
 523                     reply=0;
 524                     break;
 525                 case 'c':
 526                     crc=1;
 527                     break;
 528                 case 'p':
 529                     power=1;
 530                     break;
 531                 case 'a':
 532                     active=1;
 533                     break;
 534                 case 's':
 535                     active_select=1;
 536                     break;
 537                 case 'b':
 538                     sscanf(cmd+i+2,"%d",&temp);
 539                     numbits = temp & 0xFFFF;
 540                     i+=3;
 541                     while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
 542                     i-=2;
 543                     break;
 544                                 case 't':
 545                                         bTimeout=1;
 546                                         sscanf(cmd+i+2,"%d",&temp);
 547                                         timeout = temp & 0xFFFF;
 548                                         i+=3;
 549                                         while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
 550                                         i+=2;
 551                                         break;
 552                 default:
 553                     PrintAndLog("Invalid option");
 554                     return 0;
 555             }
 556             i+=2;
 557             continue;
 558         }
 559         if ((cmd[i]>='0' && cmd[i]<='9') ||
 560             (cmd[i]>='a' && cmd[i]<='f') ||
 561             (cmd[i]>='A' && cmd[i]<='F') ) {
 562             buf[strlen(buf)+1]=0;
 563             buf[strlen(buf)]=cmd[i];
 564             i++;
 565
 566             if (strlen(buf)>=2) {
 567                 sscanf(buf,"%x",&temp);
 568                 data[datalen]=(uint8_t)(temp & 0xff);
 569                 *buf=0;
 570                                 if (++datalen>sizeof(data)){
 571                                         if (crc)
 572                                                 PrintAndLog("Buffer is full, we can't add CRC to your data");
 573                                         break;
 574                                 }
 575             }
 576             continue;
 577         }
 578         PrintAndLog("Invalid char on input");
 579         return 0;
 580     }
 581     if(crc && datalen>0 && datalen<sizeof(data)-2)
 582     {
 583         uint8_t first, second;
 584         ComputeCrc14443(CRC_14443_A, data, datalen, &first, &second);
 585         data[datalen++] = first;
 586         data[datalen++] = second;
 587     }
 588
 589     if(active || active_select)
 590     {
 591         c.arg[0] |= ISO14A_CONNECT;
 592         if(active)
 593             c.arg[0] |= ISO14A_NO_SELECT;
 594     }
 595         if(bTimeout){
 596             #define MAX_TIMEOUT 624*105 // max timeout is 624 ms
 597         c.arg[0] |= ISO14A_SET_TIMEOUT;
 598         c.arg[2] = timeout * 105; // each bit is about 9.4 us
 599         if(c.arg[2]>MAX_TIMEOUT) {
 600             c.arg[2] = MAX_TIMEOUT;
 601             PrintAndLog("Set timeout to 624 ms. The max we can wait for response");
 602         }
 603         }
 604     if(power)
 605         c.arg[0] |= ISO14A_NO_DISCONNECT;
 606     if(datalen>0)
 607         c.arg[0] |= ISO14A_RAW;
 608
 609         // Max buffer is USB_CMD_DATA_SIZE
 610     c.arg[1] = (datalen & 0xFFFF) | (numbits << 16);
 611     memcpy(c.d.asBytes,data,datalen);
 612
 613     SendCommand(&c);
 614
 615     if (reply) {
 616         if(active_select)
 617             waitCmd(1);
 618         if(datalen>0)
 619             waitCmd(0);
 620     } // if reply
 621     return 0;
 622 }
 623
 624 static void waitCmd(uint8_t iSelect)
 625 {
 626     uint8_t *recv;
 627     UsbCommand resp;
 628     char *hexout;
 629
 630     if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 631         recv = resp.d.asBytes;
 632         uint8_t iLen = iSelect ? resp.arg[1] : resp.arg[0];
 633         PrintAndLog("received %i octets",iLen);
 634         if(!iLen)
 635             return;
 636         hexout = (char *)malloc(iLen * 3 + 1);
 637         if (hexout != NULL) {
 638             for (int i = 0; i < iLen; i++) { // data in hex
 639                 sprintf(&hexout[i * 3], "%02X ", recv[i]);
 640             }
 641             PrintAndLog("%s", hexout);
 642             free(hexout);
 643         } else {
 644             PrintAndLog("malloc failed your client has low memory?");
 645         }
 646     } else {
 647         PrintAndLog("timeout while waiting for reply.");
 648     }
 649 }
 650
 651 static command_t CommandTable[] =
 652 {
 653   {"help",   CmdHelp,              1, "This help"},
 654   {"list",   CmdHF14AList,         0, "List ISO 14443a history"},
 655   {"reader", CmdHF14AReader,       0, "Act like an ISO14443 Type A reader"},
 656   {"cuids",  CmdHF14ACUIDs,        0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
 657   {"sim",    CmdHF14ASim,          0, "<UID> -- Fake ISO 14443a tag"},
 658   {"snoop",  CmdHF14ASnoop,        0, "Eavesdrop ISO 14443 Type A"},
 659   {"raw",    CmdHF14ACmdRaw,       0, "Send raw hex data to tag"},
 660   {NULL, NULL, 0, NULL}
 661 };
 662
 663 int CmdHF14A(const char *Cmd) {
 664         // flush
 665         WaitForResponseTimeout(CMD_ACK,NULL,100);
 666
 667         // parse
 668   CmdsParse(CommandTable, Cmd);
 669   return 0;
 670 }
 671
 672 int CmdHelp(const char *Cmd)
 673 {
 674   CmdsHelp(CommandTable);
 675   return 0;
 676 }